Go 加密与 TLS从 RSA 到 ECDHE 全面实战加密与 TLS 是安全工程的基础。本文讲清 hash、对称/非对称加密、TLS 握手与现代最佳实践。一、Hash 函数importcrypto/sha256sum:sha256.Sum256([]byte(hello))fmt.Printf(%x,sum)其它sha1已不安全、sha512、blake2b。二、HMACimportcrypto/hmacmac:hmac.New(sha256.New,[]byte(secret))mac.Write([]byte(message))mac.Sum(nil)三、对称加密AESimportcrypto/aesimportcrypto/cipherkey:[]byte(1234567890123456)block,_:aes.NewCipher(key)gcm,_:cipher.NewGCM(block)nonce:make([]byte,gcm.NonceSize())io.ReadFull(rand.Reader,nonce)ct:gcm.Seal(nil,nonce,[]byte(payload),nil)AES-GCM 提供加密 完整性校验。四、非对称加密RSApriv,_:rsa.GenerateKey(rand.Reader,2048)pub:priv.PublicKey ct,_:rsa.EncryptOAEP(sha256.New(),rand.Reader,pub,msg,nil)pt,_:rsa.DecryptOAEP(sha256.New(),rand.Reader,priv,ct,nil)RSA 速度慢仅用于会话密钥分发。五、ECDHE 临时密钥importcrypto/ecdhpriv,_:ecdh.P256().GenerateKey(rand.Reader)shared,_:priv.ECDH(peerPub)现代 TLS 走 ECDHE。六、TLS 握手client → hello server → hello, cert, ECDHE client → ECDHE, Finished七、TLS Serverimportcrypto/tlscert,_:tls.LoadX509KeyPair(cert.pem,key.pem)config:tls.Config{Certificates:[]tls.Certificate{cert}}ln,_:tls.Listen(tcp,:443,config)八、TLS Clientconn,_:tls.Dial(tcp,example.com:443,tls.Config{})九、mTLS双向认证caPool:x509.NewCertPool()caPool.AddCert(caCert)clientCert,_:tls.LoadX509KeyPair(client.pem,client-key.pem)config:tls.Config{Certificates:[]tls.Certificate{clientCert},ClientCAs:caPool,ClientAuth:tls.RequireAndVerifyClientCert,}十、TLS 1.3Go 1.13 默认 TLS 1.3。特点0-RTT仅 forward-secret协议简化十一、密码学库推荐Standard library基础够用golang.org/x/crypto扩展blowfish、chacha20等filippo.io/edwards25519curves25519十二、KDFimportgolang.org/x/crypto/pbkdf2key:pbkdf2.Key([]byte(password),[]byte(salt),116,32,sha256.New)十三、企业实战mTLS service meshSidecar 间通信都强制 mTLS。十四、JWT 与加密importgithub.com/golang-jwt/jwt/v5token:jwt.NewWithClaims(jwt.SigningMethodRS256,claims)s,_:token.SignedString(privateKey)十五、踩坑清单用 MD5 / SHA1 当 hash 关键字 → 弱嵌入式证书泄露库版本老随时升级十六、性能AES-NI 提速ECDHE 比 RSA 快 10x十七、未来后量子加密KyberTLS 1.4十八、总结与展望掌握 hash、AES/RSA、TLS、mTLS 与现代 Best Practice能让项目抵御大多数风险。未来crypto 子包继续扩充post-quantum 算法将逐步标准化。十九、参考文献Go 标准库 cryptoRFC 8446 TLS 1.3NIST PQC 算法集